dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0

Analysis

Target

dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe
Size

25KB
MD5

278cf0ac45091dd3e94faeb6d77e7331
SHA1

5f8272f9f2f0c4d34b080ad50751761bfb3bf527
SHA256

dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0
SHA512

7c7181657e33bfe64b337b1877e5423147fec221b8ed363bdcf568387585c680e7424f335129a9ec4c120437db7e96344fa1da5771852ed5f8a85db6c1a0bd21

Score

10^/10

evasion suricata

suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe

description	pid	process
Token: SeDebugPrivilege	1340	dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe
Token: 33	1340	dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe
Token: SeIncBasePriorityPrivilege	1340	dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe
Token: 33	1340	dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe
Token: SeIncBasePriorityPrivilege	1340	dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe
Token: 33	1340	dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe
Token: SeIncBasePriorityPrivilege	1340	dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe
Token: 33	1340	dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe
Token: SeIncBasePriorityPrivilege	1340	dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe

description	pid	process	target process
PID 1340 wrote to memory of 3888	1340	dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe	netsh.exe
PID 1340 wrote to memory of 3888	1340	dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe	netsh.exe
PID 1340 wrote to memory of 3888	1340	dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe
"C:\Users\Admin\AppData\Local\Temp\dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe" "dda9f301fefb543235cd29166dd7bf306e2d52fa6126c887f12c1f4a2c8a3fb0.exe" ENABLE
  2⤵
  PID:3888

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1340-130-0x0000000074C10000-0x00000000751C1000-memory.dmp

Filesize
5.7MB

Download
memory/3888-131-0x0000000000000000-mapping.dmp

Download